Web sites such as Internet sites often provide information, products, services, and the like to their users. Many web sites require users to register before their web servers will grant access to the users. During registration, a user typically supplies personal information such as a username, account number, address, telephone number, e-mail address, computer platform, age, gender, and/or hobbies to the registering web site. The registration information may be necessary to complete transactions (e.g., commercial or financial transactions). Typically, the information also permits the web site to contact the user directly (e.g., via electronic mail) to announce, for example, special promotions, new products, or new web site features. Additionally, web sites often collect user information so web site operators can better target future marketing activities or adjust the content provided by the sites.
When registering a user for the first time, a web site typically requests that the user select a login identifier, or login ID, and an associated password. The login ID allows the web site to identify the user and retrieve information about the user during subsequent user visits to the web site. Generally, the login ID must be unique to the web site such that no two users have the same login ID. The combination of the login ID and password associated with the login ID allows the web site to authenticate the user during subsequent visits to the web site. The password also prevents others (who do not know the password) from accessing the web site using the user's login ID. This password protection is particularly important if the web site stores private or confidential information about the user, such as financial information or medical records.
If the user visits several different web sites, each web site may require entry of similar registration information about the user, such as the user's name, mailing address, and e-mail address. This repeated entry of identical data is tedious when visiting multiple web sites in a short period of time. Many web sites require the user to register before accessing any information provided on the site. Thus, the user must first enter the requested registration information before he or she can determine whether the site contains any information of interest.
After registering with multiple web sites, the user must remember the specific login ID and password used with each web site or other network service. Without the correct login ID and password, the user must re-enter the registration information. A particular user is likely to have different login IDs and associated passwords on different web sites. For example, a user named Bob Smith may select “smith” as his login ID for a particular site. If the site already has a user with a login ID of “smith” or requires a login ID of at least six characters, then the user must select a different login ID. After registering at numerous web sites, Bob Smith may have a collection of different login IDs such as: smith, smith1, bsmith, smithb, bobsmith, bob_smith, and smithbob. Further, different passwords may be associated with different login IDs due to differing password requirements of the different web sites (e.g., password length requirements or a requirement that each password include at least one numeric character and/or at least one uppercase character). Thus, Bob Smith must maintain a list of web sites, login IDs, and associated passwords for all sites that he visits regularly.
Although presently available multi-site user authentication systems permit a web user to maintain a single login ID (and associated password) for accessing multiple, affiliated web servers or services, further improvements are desired. When a user on a client computer communicates with server such as a web site via, for example, a hypertext transfer protocol (HTTP), there is often a need to share authentication information between the client and the server. Transactional communications between a client computer and a server computer are at risk of interception by a third party. For example, there is a risk of a spoofing attack. A spoofing attack is an attack that attempts to con one or more users into making security decisions based on a misleading context. This is often in the form of a single web page interface, but can be as involved as an entire website (or several websites). This type of attack is especially dangerous because the user is lulled into a false sense of security into a context that is completely controlled by an attacker. The goal for an attacker can range from communicating misleading information to compromising security credentials and other personal information from users. There have been high profile attacks against existing web sites in which user profile data and financial information have been compromised.
Web spoofing poses a threat to both businesses and end users as authentication through web pages becomes more pervasive. Authentication systems play a critical role in enabling products and services. Web spoofing attacks designed to capture credentials not only compromise individual user accounts, but also compromise the security of the entire authentication system. In particular, in a single sign-in authentication service, compromise of user credentials results in compromise of credentials at nearly all affiliates simultaneously. Users have been educated to expect to see authentication system login pages at increasing locations (e.g., inline sign-in) and to type their password when prompted; therefore, a new unexpected location (e.g., a spoofed location) is not surprising to the user. Any web spoofing attack on an authentication service decreases the trustworthiness of the authentication service. There is a need for tools to help users defend themselves against this kind of attack.
Spoofing affects both client applications and the web. Spoofing a client application requires getting code to run on a user's machine that has been compromised. There have been no viable solutions in present systems to client application spoofing because any solution has to distrust programs running on a user's machine. Conversely, with web spoofing, no compromise of the user's machine is necessary. However, to enable a trust scenario between the user and the login page, the user needs to be able to authenticate the authentication server or other service before the user discloses sensitive information.
Existing systems primarily focus on user education as the key to combating web spoofs. While an informed user base is beneficial, education alone is not sufficient to prevent web spoofing. In such existing systems, users have been instructed that reading the address bar in the browser or verifying a secure sockets layer (SSL) certificate is enough to verify the identify of a website. However, these tools have been shown to be ineffective at solving the web spoofing problem. For example, an attacker can spoof the web browser itself and show a spoofed address bar, status bar (including SSL lock icon) as well as the SSL dialog. That is, a user reading the address bar and the SSL certificate can still be easily spoofed by an attacker.
Another existing system to prevent web spoofing includes assigning colors to browser windows or frames and informing the user in one window of the expected color of another window. However, such a system requires modifications to the browser software and is not customizable by the user. Similarly, other existing systems for the prevention of web spoofing involve client downloads. However, a majority of users have ignored such systems by failing to download the software modifications. There is a need for a web spoofing solution for users who use a dumb client (e.g., web browser) and will not download additional software. The problem of web spoofing remains given that user education is not enough and that users will not download client software.
For these reasons, a system for authentication of a server by a client to prevent fraudulent user interfaces is desired to address one or more of these and other disadvantages.